The prospect asks how each customer’s data is kept apart.
Every query is limited to the customer who is asking, on the server. A test with two customer accounts proves it.
The deal is waiting on your security answers. Fix the gaps, then answer honestly.
A big prospect sent a security questionnaire. We fix the gaps behind the answers in your code and hosting, and write it down, so you can answer honestly.
Starts with the €1,000 System Review · credited in full to the fixes within 30 days · free first meeting
First step
System Review · about a week
We never write an answer that is not true. We fix the gap first, then you answer yes.
Honest answers
2018
Building and running live software since
7
Products of our own we run live, with real users
1 week
System Review, usually delivered within a week
3
Cities: Istanbul, Amsterdam and Miami
What we usually hear
The questions that stall a deal, and what we fix behind each one
Who it is for
For SaaS products that sell to businesses
Data separation · Access · Backups · Logging · Secrets
A good fit
A bigger customer wants answers before they sign.
- You sell a SaaS product to businesses, and a security questionnaire stands between you and the contract.
- You want answers that are true, not answers that only sound good.
- You own the code, the hosting and the accounts, or you can get them back.
Not a fit yet
Need a SOC 2 report?
That comes from an independent auditor, and we are not one.
We fix and write down what the auditor will look at.
Not a fit yet
Want the answers filled in for you?
We do not write answers that are not true yet.
Start with the review; it shows which answers need a fix first.
Before you answer
The security questionnaire checklist
Sixteen things most security questionnaires ask about, in plain words. Tick what you could prove today. Your ticks are saved only in your browser.
0 of 16 confirmed
Tick only what you can confirm, not what you assume. Several answers would be “not sure” today. That is common, and the System Review marks each one: true today, true after a fix, or not true yet. Most answers would hold. The unticked items are the questions that usually stall a deal. All 16 you could prove today. Keep it true as the product changes.
-
01
Customer data kept apart
3 checks -
02
Access
4 checks -
03
Secrets and keys
2 checks -
04
Backups and recovery
2 checks -
05
Logging
2 checks -
06
Updates and changes
3 checks
How we work
Find the gaps, fix them, then write it down
-
01 · Review
What happens
System Review, in About a Week
We read the questionnaire, the code, the hosting and who has access, and mark each question: true today, true after a fix, or not true yet.
-
02 · Fix
What happens
The Gaps That Block the Deal
Customer data kept apart, old logins removed, keys out of the code, two-factor sign-in, tested backups and logging. Usually days to a few weeks.
-
03 · Document
What happens
Documents You Can Answer From
Short documents on access, backups, logging, updates and incidents. You answer honestly, and reuse them for the next questionnaire.
-
04 · Run
What happens
Keep It True
On a monthly plan we update packages, check backups, review access and keep the documents current.
In production
The same pieces run in our products and for clients
Each user’s data kept apart, tested backups, logging and locked-down access are part of every product we run, our own and our clients’.
FAQ
Questions founders ask before they answer a questionnaire
No. A SOC 2 report comes from an independent auditor, a licensed CPA firm, and we are not one. We fix the engineering that an auditor and your prospect will look at, and write it down. Some prospects accept honest answers and a dated plan before a report exists; others will still ask for the report.
We help you answer it, but you sign it. We mark each question as true today, true after a fix, or not true yet, and draft the technical answers for you to check. We never write an answer that is not true.
The review takes about a week. Most fixes take days to a few weeks. If the prospect has a deadline, tell us in your first message and we plan the work around it.
No. We check the same things in any stack: row-level security in Supabase, checks on the server, keys and backups. AI-built apps often have gaps exactly here, so the review matters even more.
For the review, read access to the code, the hosting and the settings is enough. Where we must work in production, we do it in your own accounts, and we sign an NDA if you need one.
The documents stay yours. On a monthly plan we keep them true: updates, access reviews and backup checks. The next questionnaire is then a few days of work, not a scramble.
